Struct SecurityConfigFields 

#[non_exhaustive]
pub struct SecurityConfigFields {
    pub max_file_size: u64,
    pub max_total_size: u64,
    pub max_compression_ratio: f64,
    pub max_file_count: usize,
    pub max_path_depth: usize,
    pub allowed: AllowedFeatures,
    pub preserve_permissions: bool,
    pub allowed_extensions: Vec<String>,
    pub banned_path_components: Vec<String>,
    pub allow_solid_archives: bool,
    pub max_solid_block_memory: u64,
    pub max_tar_metadata_bytes: u64,
    /* private fields */
}

The field data of a SecurityConfig, reachable via Deref/DerefMut regardless of (or gated by) validation state.

This type is not itself part of the sealing boundary — it is a plain data bag with pub fields, and nothing stops external code from naming it or cloning one out of a &SecurityConfig. The boundary is SecurityConfig’s own private fields member: there is no public API that takes a bare SecurityConfigFields and wraps it back into a SecurityConfig<Validated>, so an externally-forged or externally-mutated SecurityConfigFields value can never be smuggled into a Validated config. It exists purely so SecurityConfig can implement Deref/ DerefMut and keep cfg.max_file_size-style field access working for every existing caller instead of forcing a getter-method migration.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

max_file_size: u64

Maximum size for a single file in bytes.

max_total_size: u64

Maximum total size for all extracted files in bytes.

max_compression_ratio: f64

Maximum compression ratio allowed (uncompressed / compressed).

max_file_count: usize

Maximum number of files that can be extracted.

max_path_depth: usize

Maximum path depth allowed.

allowed: AllowedFeatures

Feature flags controlling what archive features are allowed.

Use this to enable symlinks, hardlinks, absolute paths, etc.

preserve_permissions: bool

Preserve file permissions from archive.

allowed_extensions: Vec<String>

List of allowed file extensions (empty = allow all).

Extensions are matched case-insensitively (e.g., "txt" matches both file.txt and file.TXT). The leading dot must be omitted.

When this list is non-empty, files without a file extension are treated as not allowed and will be skipped during extraction.

banned_path_components: Vec<String>

List of banned path components (e.g., “.git”, “.ssh”).

allow_solid_archives: bool

Allow extraction from solid 7z archives.

Solid archives compress multiple files together as a single block. While this provides better compression ratios, it has security implications:

• Memory exhaustion: Extracting a single file requires decompressing the entire solid block into memory
• Denial of service: Malicious archives can create large solid blocks that exhaust available memory

Security Recommendation: Only enable for trusted archives.

Default: false (solid archives rejected)

max_solid_block_memory: u64

Maximum memory for solid archive extraction (bytes).

7z Solid Archive Memory Model:

Solid compression in 7z stores multiple files in a single compressed block. Extracting ANY file requires decompressing the ENTIRE solid block into memory, which can cause memory exhaustion attacks.

Validation Strategy:

• Pre-validates total uncompressed size of all files in archive
• This is a conservative heuristic (assumes single solid block)
• Reason: sevenz-rust2 v0.20 doesn’t expose solid block boundaries

Security Guarantee:

• Total uncompressed data cannot exceed this limit
• Combined with max_file_size, prevents unbounded memory growth
• Enforced ONLY when allow_solid_archives is true

Note: Only applies when allow_solid_archives is true.

Default: 512 MB (536,870,912 bytes)

Recommendation: Set to 1-2x available RAM for trusted archives only.

max_tar_metadata_bytes: u64

Maximum bytes the TAR reader may consume for headers and metadata records in the gap between two consecutive entries.

TAR Metadata Buffering Model:

GNU long-name (L), GNU long-link (K), and PAX extended header (x/g) records are buffered fully into memory by the underlying tar crate before any entry reaches the entry validator or quota tracker — a crafted record can declare a multi-gigabyte length backed by a tiny compressed stream, exhausting memory with no quota enforcement (metadata-entry decompression bomb).

Enforcement Strategy:

• A read-budget wrapper meters bytes the tar crate reads while searching for the next entry (headers, long-name/long-link/PAX records, GNU sparse extension blocks) and returns an error once max_tar_metadata_bytes is exceeded, before any oversized allocation completes
• Applies uniformly to extract, list, and verify
• The window this bounds contains no entry data — only metadata — so it does not interact with max_file_size/max_total_size. Draining an unread entry before the next header search is a separate concern (see formats::tar_metadata_limit’s module docs) bounded by synthesized-byte accounting, not by this or any other quota value
• Legitimate long-path/xattr metadata records are at most a few kilobytes each, and a GNU tar sparse file with heavy fragmentation can use up to a few thousand 512-byte extension blocks; either or both share this single budget (not “plus” each other), so the default leaves headroom for either shape, not necessarily both at their extremes simultaneously
• The real peak memory this bounds is roughly 5x the configured value (GNU sparse extension blocks expand into multiple EntryIo records per block before the growth is charged against this budget), not an exact multiple — treat it as an order-of-magnitude ceiling, not a tight bound

Default: 4 MiB (4,194,304 bytes)

Trait Implementations

impl Clone for SecurityConfigFields

fn clone(&self) -> SecurityConfigFields

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfigFields

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfigFields

fn default() -> Self

Returns the “default value” for a type.